<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/arch, branch v2.6.27.16</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>ACPI: don't load acpi_cpufreq if acpi=off</title>
<updated>2009-02-12T17:31:15+00:00</updated>
<author>
<name>Yinghai Lu</name>
<email>yhlu.kernel@gmail.com</email>
</author>
<published>2008-09-25T02:04:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=599eeaa552681c0808c1099ad595437c3fbdc4ad'/>
<id>599eeaa552681c0808c1099ad595437c3fbdc4ad</id>
<content type='text'>
commit ee297533279a802eac8b1cbea8e65b24b36a1aac upstream.

Signed-off-by: Yinghai Lu &lt;yhlu.kernel@gmail.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Signed-off-by: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit ee297533279a802eac8b1cbea8e65b24b36a1aac upstream.

Signed-off-by: Yinghai Lu &lt;yhlu.kernel@gmail.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Signed-off-by: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>PCI: return error on failure to read PCI ROMs</title>
<updated>2009-02-12T17:31:10+00:00</updated>
<author>
<name>Timothy S. Nelson</name>
<email>wayland@wayland.id.au</email>
</author>
<published>2009-01-29T19:12:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ae59010c012538c749abc8bf760855a71b014072'/>
<id>ae59010c012538c749abc8bf760855a71b014072</id>
<content type='text'>
commit 97c44836cdec1ea713a15d84098a1a908157e68f upstream.

This patch makes the ROM reading code return an error to user space if
the size of the ROM read is equal to 0.

The patch also emits a warnings if the contents of the ROM are invalid,
and documents the effects of the "enable" file on ROM reading.

Signed-off-by: Timothy S. Nelson &lt;wayland@wayland.id.au&gt;
Acked-by: Alex Villacis-Lasso &lt;a_villacis@palosanto.com&gt;
Signed-off-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 97c44836cdec1ea713a15d84098a1a908157e68f upstream.

This patch makes the ROM reading code return an error to user space if
the size of the ROM read is equal to 0.

The patch also emits a warnings if the contents of the ROM are invalid,
and documents the effects of the "enable" file on ROM reading.

Signed-off-by: Timothy S. Nelson &lt;wayland@wayland.id.au&gt;
Acked-by: Alex Villacis-Lasso &lt;a_villacis@palosanto.com&gt;
Signed-off-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>x86: APIC: enable workaround on AMD Fam10h CPUs</title>
<updated>2009-02-12T17:31:04+00:00</updated>
<author>
<name>Borislav Petkov</name>
<email>borislav.petkov@amd.com</email>
</author>
<published>2009-02-03T15:24:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c29f6564c1910b0a5ac22c840fc5ba031cea82b1'/>
<id>c29f6564c1910b0a5ac22c840fc5ba031cea82b1</id>
<content type='text'>
commit 858770619debfb9269add63e4ba8b7c6b5538dd1 upstream.

Impact: fix to enable APIC for AMD Fam10h on chipsets with a missing/b0rked
	ACPI MP table (MADT)

Booting a 32bit kernel on an AMD Fam10h CPU running on chipsets with
missing/b0rked MP table leads to a hang pretty early in the boot process
due to the APIC not being initialized. Fix that by falling back to the
default APIC base address in 32bit code, as it is done in the 64bit
codepath.

Signed-off-by: Borislav Petkov &lt;borislav.petkov@amd.com&gt;
Signed-off-by: H. Peter Anvin &lt;hpa@zytor.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 858770619debfb9269add63e4ba8b7c6b5538dd1 upstream.

Impact: fix to enable APIC for AMD Fam10h on chipsets with a missing/b0rked
	ACPI MP table (MADT)

Booting a 32bit kernel on an AMD Fam10h CPU running on chipsets with
missing/b0rked MP table leads to a hang pretty early in the boot process
due to the APIC not being initialized. Fix that by falling back to the
default APIC base address in 32bit code, as it is done in the 64bit
codepath.

Signed-off-by: Borislav Petkov &lt;borislav.petkov@amd.com&gt;
Signed-off-by: H. Peter Anvin &lt;hpa@zytor.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>prevent kprobes from catching spurious page faults</title>
<updated>2009-02-12T17:31:03+00:00</updated>
<author>
<name>Masami Hiramatsu</name>
<email>mhiramat@redhat.com</email>
</author>
<published>2009-02-05T22:12:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=bdb6a508be1efd20d813f4e09203d42da94c9f54'/>
<id>bdb6a508be1efd20d813f4e09203d42da94c9f54</id>
<content type='text'>
commit 9be260a646bf76fa418ee519afa10196b3164681 upstream.

Prevent kprobes from catching spurious faults which will cause infinite
recursive page-fault and memory corruption by stack overflow.

Signed-off-by: Masami Hiramatsu &lt;mhiramat@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9be260a646bf76fa418ee519afa10196b3164681 upstream.

Prevent kprobes from catching spurious faults which will cause infinite
recursive page-fault and memory corruption by stack overflow.

Signed-off-by: Masami Hiramatsu &lt;mhiramat@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ACPI: Change acpi_evaluate_integer to support 64-bit on 32-bit kernels</title>
<updated>2009-02-06T22:00:42+00:00</updated>
<author>
<name>Matthew Wilcox</name>
<email>willy@linux.intel.com</email>
</author>
<published>2009-01-27T16:38:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f52ec8df5a440a438ed4b151c297f0295f8bbe21'/>
<id>f52ec8df5a440a438ed4b151c297f0295f8bbe21</id>
<content type='text'>
commit 27663c5855b10af9ec67bc7dfba001426ba21222 upstream

As of version 2.0, ACPI can return 64-bit integers.  The current
acpi_evaluate_integer only supports 64-bit integers on 64-bit platforms.
Change the argument to take a pointer to an acpi_integer so we support
64-bit integers on all platforms.

lenb: replaced use of "acpi_integer" with "unsigned long long"
lenb: fixed bug in acpi_thermal_trips_update()

Signed-off-by: Matthew Wilcox &lt;willy@linux.intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 27663c5855b10af9ec67bc7dfba001426ba21222 upstream

As of version 2.0, ACPI can return 64-bit integers.  The current
acpi_evaluate_integer only supports 64-bit integers on 64-bit platforms.
Change the argument to take a pointer to an acpi_integer so we support
64-bit integers on all platforms.

lenb: replaced use of "acpi_integer" with "unsigned long long"
lenb: fixed bug in acpi_thermal_trips_update()

Signed-off-by: Matthew Wilcox &lt;willy@linux.intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ACPI: Avoid array address overflow when _CST MWAIT hint bits are set</title>
<updated>2009-02-06T22:00:41+00:00</updated>
<author>
<name>Zhao Yakui</name>
<email>yakui.zhao@intel.com</email>
</author>
<published>2009-01-04T04:04:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3b9720cedb49b94ca1f9523da9f7c76647878b5a'/>
<id>3b9720cedb49b94ca1f9523da9f7c76647878b5a</id>
<content type='text'>
commit 13b40a1a065824d2d4e55c8b48ea9f3f9d162929 upstream.

The Cx Register address obtained from the _CST object is used as the MWAIT
hints if the register type is FFixedHW. And it is used to check whether
the Cx type is supported or not.

On some boxes the following Cx state package is obtained from _CST object:
    &gt;{
                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x01,               // Bit Width
                        0x02,               // Bit Offset
                        0x0000000000889759, // Address
                        0x03,               // Access Size
                        )
                },

                0x03,
                0xF5,
                0x015E }

   In such case we should use the bit[7:4] of Cx address to check whether
the Cx type is supported or not.

mask the MWAIT hint to avoid array address overflow

Signed-off-by: Zhao Yakui &lt;yakui.zhao@intel.com&gt;
Acked-by:Venki Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 13b40a1a065824d2d4e55c8b48ea9f3f9d162929 upstream.

The Cx Register address obtained from the _CST object is used as the MWAIT
hints if the register type is FFixedHW. And it is used to check whether
the Cx type is supported or not.

On some boxes the following Cx state package is obtained from _CST object:
    &gt;{
                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x01,               // Bit Width
                        0x02,               // Bit Offset
                        0x0000000000889759, // Address
                        0x03,               // Access Size
                        )
                },

                0x03,
                0xF5,
                0x015E }

   In such case we should use the bit[7:4] of Cx address to check whether
the Cx type is supported or not.

mask the MWAIT hint to avoid array address overflow

Signed-off-by: Zhao Yakui &lt;yakui.zhao@intel.com&gt;
Acked-by:Venki Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>cpuidle: upon BIOS bug, default to default_idle rather than polling</title>
<updated>2009-02-06T22:00:40+00:00</updated>
<author>
<name>Venkatesh Pallipadi</name>
<email>venkatesh.pallipadi@intel.com</email>
</author>
<published>2009-01-27T16:38:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7ab17915a271c29a7b8ca0383597a80866cf023c'/>
<id>7ab17915a271c29a7b8ca0383597a80866cf023c</id>
<content type='text'>
commit 89cedfefca1d446ee2598fd3bcbb23ee3802e26a upstream

http://bugzilla.kernel.org/show_bug.cgi?id=11345

Signed-off-by: Venkatesh Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 89cedfefca1d446ee2598fd3bcbb23ee3802e26a upstream

http://bugzilla.kernel.org/show_bug.cgi?id=11345

Signed-off-by: Venkatesh Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Len Brown &lt;len.brown@intel.com&gt;
Cc: Thomas Renninger &lt;trenn@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>x86: fix page attribute corruption with cpa()</title>
<updated>2009-02-06T22:00:40+00:00</updated>
<author>
<name>Suresh Siddha</name>
<email>suresh.b.siddha@intel.com</email>
</author>
<published>2009-01-29T01:03:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=dcc66ea99edf129459fad800d09d65deecaf8e7b'/>
<id>dcc66ea99edf129459fad800d09d65deecaf8e7b</id>
<content type='text'>
commit a1e46212a410793d575718818e81ddc442a65283 upstream.

Impact: fix sporadic slowdowns and warning messages

This patch fixes a performance issue reported by Linus on his
Nehalem system. While Linus reverted the PAT patch (commit
58dab916dfb57328d50deb0aa9b3fc92efa248ff) which exposed the issue,
existing cpa() code can potentially still cause wrong(page attribute
corruption) behavior.

This patch also fixes the "WARNING: at arch/x86/mm/pageattr.c:560" that
various people reported.

In 64bit kernel, kernel identity mapping might have holes depending
on the available memory and how e820 reports the address range
covering the RAM, ACPI, PCI reserved regions. If there is a 2MB/1GB hole
in the address range that is not listed by e820 entries, kernel identity
mapping will have a corresponding hole in its 1-1 identity mapping.

If cpa() happens on the kernel identity mapping which falls into these
holes,
existing code fails like this:

__change_page_attr_set_clr()
	__change_page_attr()
		returns 0 because of if (!kpte). But doesn't
		set cpa-&gt;numpages and cpa-&gt;pfn.
	cpa_process_alias()
		uses uninitialized cpa-&gt;pfn (random value)
		which can potentially lead to changing the page
		attribute of kernel text/data, kernel identity
		mapping of RAM pages etc. oops!

This bug was easily exposed by another PAT patch which was doing
cpa() more often on kernel identity mapping holes (physical range
between
max_low_pfn_mapped and 4GB), where in here it was setting the
cache disable attribute(PCD) for kernel identity mappings aswell.

Fix cpa() to handle the kernel identity mapping holes. Retain
the WARN() for cpa() calls to other not present address ranges
(kernel-text/data, ioremap() addresses)

Signed-off-by: Suresh Siddha &lt;suresh.b.siddha@intel.com&gt;
Signed-off-by: Venkatesh Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a1e46212a410793d575718818e81ddc442a65283 upstream.

Impact: fix sporadic slowdowns and warning messages

This patch fixes a performance issue reported by Linus on his
Nehalem system. While Linus reverted the PAT patch (commit
58dab916dfb57328d50deb0aa9b3fc92efa248ff) which exposed the issue,
existing cpa() code can potentially still cause wrong(page attribute
corruption) behavior.

This patch also fixes the "WARNING: at arch/x86/mm/pageattr.c:560" that
various people reported.

In 64bit kernel, kernel identity mapping might have holes depending
on the available memory and how e820 reports the address range
covering the RAM, ACPI, PCI reserved regions. If there is a 2MB/1GB hole
in the address range that is not listed by e820 entries, kernel identity
mapping will have a corresponding hole in its 1-1 identity mapping.

If cpa() happens on the kernel identity mapping which falls into these
holes,
existing code fails like this:

__change_page_attr_set_clr()
	__change_page_attr()
		returns 0 because of if (!kpte). But doesn't
		set cpa-&gt;numpages and cpa-&gt;pfn.
	cpa_process_alias()
		uses uninitialized cpa-&gt;pfn (random value)
		which can potentially lead to changing the page
		attribute of kernel text/data, kernel identity
		mapping of RAM pages etc. oops!

This bug was easily exposed by another PAT patch which was doing
cpa() more often on kernel identity mapping holes (physical range
between
max_low_pfn_mapped and 4GB), where in here it was setting the
cache disable attribute(PCD) for kernel identity mappings aswell.

Fix cpa() to handle the kernel identity mapping holes. Retain
the WARN() for cpa() calls to other not present address ranges
(kernel-text/data, ioremap() addresses)

Signed-off-by: Suresh Siddha &lt;suresh.b.siddha@intel.com&gt;
Signed-off-by: Venkatesh Pallipadi &lt;venkatesh.pallipadi@intel.com&gt;
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</pre>
</div>
</content>
</entry>
<entry>
<title>PCI: irq and pci_ids patch for Intel Tigerpoint DeviceIDs</title>
<updated>2009-02-06T22:00:38+00:00</updated>
<author>
<name>Seth Heasley</name>
<email>seth.heasley@intel.com</email>
</author>
<published>2009-01-23T20:43:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4326eb09d53c8c5e4995bde12c09af77d3a94f53'/>
<id>4326eb09d53c8c5e4995bde12c09af77d3a94f53</id>
<content type='text'>
commit 57064d213d2e44654d4f13c66df135b5e7389a26 upstream.

This patch adds the Intel Tigerpoint LPC Controller DeviceIDs.

Signed-off-by: Seth Heasley &lt;seth.heasley@intel.com&gt;
Signed-off-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 57064d213d2e44654d4f13c66df135b5e7389a26 upstream.

This patch adds the Intel Tigerpoint LPC Controller DeviceIDs.

Signed-off-by: Seth Heasley &lt;seth.heasley@intel.com&gt;
Signed-off-by: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>x86: use early clobbers in usercopy*.c</title>
<updated>2009-02-06T22:00:35+00:00</updated>
<author>
<name>Andi Kleen</name>
<email>andi@firstfloor.org</email>
</author>
<published>2009-01-16T14:22:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0d7fbf8ae56d28b9bfbc1c42decdf2a812715066'/>
<id>0d7fbf8ae56d28b9bfbc1c42decdf2a812715066</id>
<content type='text'>
commit e0a96129db574d6365e3439d16d88517c437ab33 upstream.

Impact: fix rare (but currently harmless) miscompile with certain configs and gcc versions

Hugh Dickins noticed that strncpy_from_user() was miscompiled
in some circumstances with gcc 4.3.

Thanks to Hugh's excellent analysis it was easy to track down.

Hugh writes:

&gt; Try building an x86_64 defconfig 2.6.29-rc1 kernel tree,
&gt; except not quite defconfig, switch CONFIG_PREEMPT_NONE=y
&gt; and CONFIG_PREEMPT_VOLUNTARY off (because it expands a
&gt; might_fault() there, which hides the issue): using a
&gt; gcc 4.3.2 (I've checked both openSUSE 11.1 and Fedora 10).
&gt;
&gt; It generates the following:
&gt;
&gt; 0000000000000000 &lt;__strncpy_from_user&gt;:
&gt;    0:   48 89 d1                mov    %rdx,%rcx
&gt;    3:   48 85 c9                test   %rcx,%rcx
&gt;    6:   74 0e                   je     16 &lt;__strncpy_from_user+0x16&gt;
&gt;    8:   ac                      lods   %ds:(%rsi),%al
&gt;    9:   aa                      stos   %al,%es:(%rdi)
&gt;    a:   84 c0                   test   %al,%al
&gt;    c:   74 05                   je     13 &lt;__strncpy_from_user+0x13&gt;
&gt;    e:   48 ff c9                dec    %rcx
&gt;   11:   75 f5                   jne    8 &lt;__strncpy_from_user+0x8&gt;
&gt;   13:   48 29 c9                sub    %rcx,%rcx
&gt;   16:   48 89 c8                mov    %rcx,%rax
&gt;   19:   c3                      retq
&gt;
&gt; Observe that "sub %rcx,%rcx; mov %rcx,%rax", whereas gcc 4.2.1
&gt; (and many other configs) say "sub %rcx,%rdx; mov %rdx,%rax".
&gt; Isn't it returning 0 when it ought to be returning strlen?

The asm constraints for the strncpy_from_user() result were missing an
early clobber, which tells gcc that the last output arguments
are written before all input arguments are read.

Also add more early clobbers in the rest of the file and fix 32-bit
usercopy.c in the same way.

Signed-off-by: Andi Kleen &lt;ak@linux.intel.com&gt;
Signed-off-by: H. Peter Anvin &lt;hpa@zytor.com&gt;
[ since this API is rarely used and no in-kernel user relies on a 'len'
  return value (they only rely on negative return values) this miscompile
  was never noticed in the field. But it's worth fixing it nevertheless. ]
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e0a96129db574d6365e3439d16d88517c437ab33 upstream.

Impact: fix rare (but currently harmless) miscompile with certain configs and gcc versions

Hugh Dickins noticed that strncpy_from_user() was miscompiled
in some circumstances with gcc 4.3.

Thanks to Hugh's excellent analysis it was easy to track down.

Hugh writes:

&gt; Try building an x86_64 defconfig 2.6.29-rc1 kernel tree,
&gt; except not quite defconfig, switch CONFIG_PREEMPT_NONE=y
&gt; and CONFIG_PREEMPT_VOLUNTARY off (because it expands a
&gt; might_fault() there, which hides the issue): using a
&gt; gcc 4.3.2 (I've checked both openSUSE 11.1 and Fedora 10).
&gt;
&gt; It generates the following:
&gt;
&gt; 0000000000000000 &lt;__strncpy_from_user&gt;:
&gt;    0:   48 89 d1                mov    %rdx,%rcx
&gt;    3:   48 85 c9                test   %rcx,%rcx
&gt;    6:   74 0e                   je     16 &lt;__strncpy_from_user+0x16&gt;
&gt;    8:   ac                      lods   %ds:(%rsi),%al
&gt;    9:   aa                      stos   %al,%es:(%rdi)
&gt;    a:   84 c0                   test   %al,%al
&gt;    c:   74 05                   je     13 &lt;__strncpy_from_user+0x13&gt;
&gt;    e:   48 ff c9                dec    %rcx
&gt;   11:   75 f5                   jne    8 &lt;__strncpy_from_user+0x8&gt;
&gt;   13:   48 29 c9                sub    %rcx,%rcx
&gt;   16:   48 89 c8                mov    %rcx,%rax
&gt;   19:   c3                      retq
&gt;
&gt; Observe that "sub %rcx,%rcx; mov %rcx,%rax", whereas gcc 4.2.1
&gt; (and many other configs) say "sub %rcx,%rdx; mov %rdx,%rax".
&gt; Isn't it returning 0 when it ought to be returning strlen?

The asm constraints for the strncpy_from_user() result were missing an
early clobber, which tells gcc that the last output arguments
are written before all input arguments are read.

Also add more early clobbers in the rest of the file and fix 32-bit
usercopy.c in the same way.

Signed-off-by: Andi Kleen &lt;ak@linux.intel.com&gt;
Signed-off-by: H. Peter Anvin &lt;hpa@zytor.com&gt;
[ since this API is rarely used and no in-kernel user relies on a 'len'
  return value (they only rely on negative return values) this miscompile
  was never noticed in the field. But it's worth fixing it nevertheless. ]
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
</feed>
